Scanning System with Direct Access to Memory

1. A method of performing a security test at a payment terminal, the method comprising: storing, by a processing unit of the payment terminal, information in memory of the payment terminal; providing a direct connection between the memory and a secure processing portion of the payment terminal, the secure processing portion physically and logically protected from tamper attempts; accessing, by the secure processing portion, the memory via direct memory access using the direct connection; comparing, by the secure processing portion, the accessed information to corresponding evaluation criteria stored by the payment terminal; determining, by the secure processing portion, whether there is a discrepancy between the accessed information and the evaluation criteria; and initiating, by the secure processing portion, a response action in response to the determination of a discrepancy between the accessed information and the evaluation criteria.

2. The method of claim 1 , wherein the determination of a discrepancy between the accessed information and the evaluation criteria indicates that the payment terminal is performing forbidden operations.

3. The method of claim 1 , wherein the evaluation criteria are stored in a secure memory portion of the payment terminal, the secure memory portion physically and logically protected from tamper attempts.

4. The method of claim 1 , wherein the processing unit of the payment terminal comprises an application processing unit and the secure processing portion is incorporated within the application processing unit.

5. The method of claim 1 , wherein the processing unit of the payment terminal comprises an application processing unit and the secure processing portion is incorporated in a memory scanning system separate from the application processing unit.

6. The method of claim 1 , further comprising transmitting, by the secure processing portion, a message to a payment server in response to the determination of a discrepancy between the accessed information and the evaluation criteria, wherein the message includes the accessed information and information indicative of the determination of a discrepancy.

7. The method of claim 6 , further comprising: receiving, by the secure processing portion, a response message from the payment server indicating tampering at the payment terminal; and preventing, by the secure processing portion, processing of transactions in response to the response message.

8. A method of performing a security test at a device, the method comprising: storing, by a processing unit of the device, information in memory of the device via a first connection; providing a second connection between the memory and a memory scanning system of the device, the second connection being a direct connection that is separate from the first connection; accessing, by the memory scanning system, information stored in the memory via direct memory access using the second connection; comparing, by the memory scanning system, the accessed information to corresponding evaluation criteria stored by the memory scanning system; determining, by the memory scanning system, whether there is a discrepancy between the accessed information and the evaluation criteria; and initiating, by the memory scanning system, a response action in response to the determination of a discrepancy between the accessed information and the evaluation criteria.

9. The method of claim 8 , wherein the determination of a discrepancy between the accessed information and the evaluation criteria indicates that the device is performing forbidden operations.

10. The method of claim 8 , wherein the accessing information stored in the memory includes accessing information stored in the memory with a memory access controller of the memory scanning system.

11. The method of claim 8 , wherein the memory scanning system is incorporated within the processing unit of the device.

12. The method of claim 8 , wherein the memory scanning system is incorporated in a separate module from the processing unit of the device.

13. The method of claim 8 , wherein the accessing information stored in memory includes obtaining information about an operating system of the device.

14. A device for performing a security test, comprising: at least one memory; at least one processing unit coupled to the at least one memory by a first connection, wherein the at least one processing unit is configured to store information in the at least one memory via the first connection; a memory scanning system coupled to the at least one memory by a second connection, wherein the second connection is a direct connection that is separate from the first connection, the memory scanning system including a processing portion and a memory portion, wherein the memory portion comprises instructions that cause the processing portion to: access information stored in the at least one memory via direct read access using the second connection; compare the accessed information to corresponding evaluation criteria stored in the memory portion of the memory scanning system; determine whether there is a discrepancy between the accessed information and the evaluation criteria; and initiate a response action in response to the determination of a discrepancy between the accessed information and the evaluation criteria.

15. The device of claim 14 , wherein the memory scanning system is separate from the at least one processing unit.

16. The device of claim 14 , wherein the memory scanning system is included within the at least one processing unit.

17. The device of claim 16 , wherein the at least one processing unit comprises a secure enclave, wherein the processing portion of the memory scanning system and the memory portion of the memory scanning system are included within the secure enclave.

18. The device of claim 14 , wherein the memory scanning system comprises a memory access controller to access the at least one memory in response to instructions from the processing portion.

19. The device of claim 14 , wherein the evaluation criteria includes a plurality of test criteria and wherein the discrepancy between the accessed information and the evaluation criteria indicates that the at least one processing unit is performing forbidden operations.

20. The device of claim 19 , wherein the instructions in the memory portion cause the processing portion to send a message via a networking stack in the at least one memory in response to the determination that the at least one processing unit is performing forbidden operations.